Cisco VRF lite on FG with GRE over IPSec

[volkovski]

Hello all, I have the following scenario: - I need to create GRE over IPSec between Cisco and FG 100D due to running BGP over. - I need to separate global routing table (the IPsec is created on the global routing table) and " BGP domain" routing table - GRE over IPsec and BGP is already running on my FG, but I have a problem to configure the rest. - I found that there are VDOM on FG + VDOM link, but I dont understand how to link root VDOM with Customer VDOM and run GRE over IPSec + BGP to this VDOM. Cisco configuration example - tunnel is based on global routing table, inside of tunnel in within customer routing table: interface Tunnel1 description GRE tunnel to FG ip vrf forwarding customer ip address 10.2.1.1 255.255.255.252 tunnel source X.X.X.X tunnel destination Y.Y.Y.Y tunnel protection ipsec profile vpnprof Fortigate configuration : edit " ipsec_phase1" set vdom " root" set ip Y.Y.Y.Y 255.255.255.255 set allowaccess ping set type tunnel set remote-ip X.X.X.X set snmp-index 12 set interface " wan1" edit " gre1" set vdom " root" set ip 10.2.1.2 255.255.255.255 set allowaccess ping set type tunnel set remote-ip 10.2.1.1 set snmp-index 13 set interface " ipsec_phase1" config system gre-tunnel edit " gre1" set interface " ipsec_phase1" set local-gw Y.Y.Y.Y set remote-gw X.X.X.X next Any help would be appreciated. Thanks a lot in advance.

[Carl_Wallmark]

Hi, Yes Vdoms + vdom links is the right way. You create a link between the two vdoms and make sure to give the vdom links IP addresses (for example with /31) Then you can use the links in routing with BGP. Very straight forward.

[volkovski]

Hello Selective, thanks for the reply. Could you give me an example ? GRE tunnel FG 10.2.1.2 - 10.2.1.1 Cisco /30 GRE tunnel FG should be terminated in root VDOM or customer VDOM ? I' m not sure how to bind GRE tunnel with VDOM link and which address add to VDOM link? Thanks a lot

[Carl_Wallmark]

Hi, Sorry for late respons. You do not bind the GRE tunnel to a vdom link. Make the GRE tunnel on one of your VDOMS, (which suits you the most). Then you can use the vdom links to move traffic between the vdoms.

[volkovski]

Hi, " Make the GRE tunnel on one of your VDOMS, (which suits you the most). " 1) If I make the GRE tunnel on " customer" VDOM, Im unable to run GRE over IPSec. IPSec is bound with WAN interface (with public WAN IP) in " root" VDOM and there is L3 VDOM link in FG. 2) If I make the GRE t. on " root" VDOM, Im able to run BGP over GRE and also between VDOMs, BUT there is a problem with " customers" def. route propagated via BGP in root VDOM. The static one is prefered... Without static one I can' t build up the IPSec. = i.e. deadlock. PS: If there is something like local policy based routing similar to CISCO everything would be fine. :) Thank you

[emnoc]

On #1: why can' t you bind the tunnel to a vdom interface where the customer is at On #2: a simple prefix-list and filtering would drop any thing that you don' t want to adv or learn

[volkovski]

On #1: why can' t you bind the tunnel to a vdom interface where the customer is at

Hi, here is my scenario : cisco GRE (10.2.1.1/30 - 10.2.1.2/30 ) FG gre customer VDOM link (10.1.1.1/30 - 10.1.1.2/30) root VDOM ipsec_phase1 interface (Y.Y.Y.Y - X.X.X.X) - Cisco Endpoint WAN link FG (Y.Y.Y.Y - X.X.X.X) - Cisco Endpoint Could you try to help me with configuration ? edit " gre1" set vdom " customer" set ip 10.2.1.2 255.255.255.255 set allowaccess ping set type tunnel set remote-ip 10.2.1.1 set snmp-index 13 set interface " vlink11" -> the VDOM link within customer VDOM What the GRE tunnel config should be look like ? config system gre-tunnel edit " gre1" set interface " vlink11" ????? set local-gw Y.Y.Y.Y -> WAN ip in root VDOM ???? set remote-gw X.X.X.X next